Major bug in urlprotect found, anybody can kill your server!

[jerry2]

I am really pissed off! Fix the bugs!

I have enough of ignorance. I wrote about this error that ANYBODY can kill any application pool from a simple % in the address bar in browser and SWsoft ignores it:

http://forum.swsoft.com/showthread.php?t=54142

Now IO have updated from 8.4 to 8.6 just to find out that my MyODBC 5.1 I have been using for months doesn't work any more with Plesk 8.6. Why not? 5.1 is not beta, it is release for ages. And it worked before. I don't know why the driver can not be loaded, I have reinstalled myODBC several times, no help. 3.51 works, but I moved to the new version.

And don't tell me it is not supported. It woked from 7.5 on and now it doesn't. So my site is off, I can ot migrate from 8.6 back and I can not test if the ISAPI URLRewrite works or not now.

Any please don't tell me to write complex bug reports as the form is too long, I don't want to give credentials to my server and the bugs are easy tracable. The bug report is a big form that needs paid support, I don't have and I don't need one, but fix things. Plesk people can be happy we write about the problems here on the forum I think. It was their job in the first place.

And don't tell me nobody from Swsoft read this forum, becaue I know at least Sergius does.

Sorry about my voice, I never had such voice, I am really angry on SwSoft rigth now.

Jerry

 

[jerry2]

The problem with ODBC can be fixed "by hand". The ODBC must be installed to the system folder, so one must use the ODBC 5.1 that is without installer and do it by hand.

I am sorry to inform you all that the urlprotect.dll isn't fixed. If you use protected folders anaybody give me your domain name and I'll kill your application pool in 10 seconds only with URL address bar (no hacking).

I think this is serious enough!

 

[jerry2]

Yes, the statistics.exe doesn't work now also, as somebody else mentioned.

 

[jerry2]

I won't duplicate myself, but maybe SWSoft only looks at 8.6 troubleshooting now, so I take a chance and link this major bug:

http://forum.swsoft.com/showthread.php?t=54142

 

[sergius]

Hello Jerry,

Thank you for the reports.

The issue will be fixed as soon as possible.

 

[jerry2]

Thank you Sergius. PLEASE fix the urlprotect.dll ASAP and send me link to the new file. My application pool gets killed every few days by this, I am not sure if anybody reads this forums or the hacker bots make the dreaded % in URL's (not followed by 2 other digits) but they are killing the pools. I have now allowed 100 errors before it shuts down to "fix" this, but my servers and servers of anybody who use urlprotect.dll (protected folders) is at great risk. Thanks.

 

[NeuroPsyche]

Jerry,

Whats new? Did you expect anything good to become of Plesk? I think they(Parallels) has a financial
issue and are falling apart. I truly beleive that they've(Parallels/SWSoft) has come to the point that
they no longer employ and 'what they term as engineers' software writers that know anything about...
well, writing good, solid, code.

I just purchased another Plesk license, renewed my SUS and support, to find that after I upgraded to
8.6.0, everything again seems to be hanging on by strings... about ready to crash.

I don't know how many of you are running Win2k8, oh its quite a joy! Try it! Then, read your event logs.
You'll be surprised your machine is even running yet and didn't come into a fatal system error. )

 

[jerry2]

I do not know about financial issues of SWSoft and I don't really care.

But the statistics doesn't work for me and anybody can break my server that's as good as running a bomb. And I can not go back to 8.4 :-( I migrated just because of DNS issues (security risks).

 

[sergius]

Gentlemen,

Please download updated module urlprotect.dll and copy it to the folder %plesk_bin%.
Please stop IIS before copying and start after.
Please backup old module before copying.

Any feedback is appreciated.

 

[MattYM@]

Gentlemen,

Please download updated module urlprotect.dll and copy it to the folder %plesk_bin%.
Please stop IIS before copying and start after.
Please backup old module before copying.

Any feedback is appreciated.

Is this for IIS6 or IIS7 or both?

 

[sergius]

Is this for IIS6 or IIS7 or both?

It is for both IIS 6 and IIS 7.

 

[jerry2]

I have upgraded to 8.6, is this for 8.6 also or only 8.4 Plesk

 

[jerry2]

Seems it work on 8.6, I will try on 8.4 also.

Thank you. You can give me a free Plesk licence for finding this major bug I have lost the hair out of it.

 

[MattYM@]

Do you mean copy it to c:\program files\Swsoft\Plesk\isapi and not %plesk_bin% ?

Also looking at the file version this urlprotect.dll seems to be from Plesk 8.4 and is smaller in size slightly than the one with 8.6.

 

[jerry2]

It works, yes put it in isapi of course.

 

[efisher@]

It works, yes put it in isapi of course.

I tried putting urlprotect.dll in my isapi directory and after I restarted IIS, half my sites wouldn't load.

In fact, in the event log, I get a lot of these messages:

"Could not load all ISAPI filters for site/service. Therefore startup aborted."

Not good. Can we confirm where the file is supposed to go and if this file works at all?

-Eric

 

[globalmcs]

I tested your finding and my server is vulnerable, I tried to apply the updated urlprotect.dll but it didn't work with 8.6, I got the following error - Now I'm waiting for "Parallels" to solve the problem.

Event Type: Error
Event Source: W3SVC-WP
Event Category: None
Event ID: 2268
Date: 8/21/2008
Time: 9:15:30 PM
User: N/A
Computer: COMPUTERNAME
Description:
Could not load all ISAPI filters for site/service. Therefore startup aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: e6 03 00 00 æ...

 

[efisher@]

I tested your finding and my server is vulnerable, I tried to apply the updated urlprotect.dll but it didn't work with 8.6, I got the following error - Now I'm waiting for "Parallels" to solve the problem.

Event Type: Error
Event Source: W3SVC-WP
Event Category: None
Event ID: 2268
Date: 8/21/2008
Time: 9:15:30 PM
User: N/A
Computer: COMPUTERNAME
Description:
Could not load all ISAPI filters for site/service. Therefore startup aborted.

For more information, see Help and Support Center at http://go.microsoft.com/fwlink/events.asp.
Data:
0000: e6 03 00 00 æ...

This is exactly what I saw as well.

Parallels, please fix!!!!